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This report is also accompanied by ANNEXES, comprising: 

a. EU (sent to the applicant and to the International Bureau) a total of 
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□ sheets of the description, claims and/or drawings which have been amended and are the basis of this report 
and/or sheets containing rectifications authorized by this Authority (see Rule 70.16 and Section 607 of the 
Administrative Instructions). 

□ sheets which supersede earlier sheets, but which this Authority considers contain an amendment that goes 
beyond the disclosure in the international application as filed, as indicated in item 4 of Box No. I and the 
Supplemental Box. 
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Box No. I 


Basis of the report 




1. 


With regard to the language, this report is based on the international application in the language in which it was filed, unless 
otherwise indicated under this item. 






This rppnrf is hased on a translation from the original language into the following language encfl X sh , 
which is the language of a translation furnished for the purposes of: 






| | international search (under Rules 1 2.3 and 23. 1 (b)) 








|^| publication of the international application (under Rule 12.4) 








| | international preliminary examination (under Rules 55.2 and/or 55.3) 


2. 


With regard to the elements of the international application, this report is bas 
furnished to the receiving Office in response to an invitation under Article 14 are 
and are not annexed to this report): 


ed on (replacement sheets which have been 
referred to in this report as "originally filed" 




M 


the international application as originally fued/furnished 
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□ 


the description: 
oaees 


as originally filed/furnished 






pages* received by this Authority on 






Twaes* received by this Authority on 




HI 
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the claims: 
oaees 


as originally filed/furnished \ 






pages* as amended (together with any statement) under Article 19 
pages* received by this Authority on 






pages* received by this Authority on 




□ 


the drawings: 
oases 


as originally filed/furnished i 
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pages* received by this Authority on 
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□ 


a sequence listing and/or any related table(s) - see Supplemental Box Relating to Sequence Listing. 


3. 


□ 


The amendments have resulted in the cancellation of: 
I the description, pages 








| H] the claims, Nos. 








f 1 the drawings, sheets/figs 








! ] the sequence listing (specijy): 








1 any table(s) related to the secmence Hstmg ftpeczW: 
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□ 


This report has been established as if (some of) the amendments annexed to this report and listed below had not been 
made, since they have been considered to go beyond the disclosure as filed, as indicated in the Supplemental Box (Rule 
70.2(c)). 






I 1 the description, pages 








1 1 the claims, Nos. 








1 1 the drawings, sheets/figs 








1 1 the sequence listing (specify): 








1 any table(s) related to the sequence listing (specify): 




* 


If item 4 applies, some or all of those sheets may be marked "superseded " 
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Box No. V Reasoned statement under Article 35(2) with regard to novelty, inventive step or industrial applicability; 
citations and explanations supporting such statement 



1. Statement 



Novelty (N) Claims 1-47 . — YES 

Claims NO 

Inventive step (IS) Claims 17-20. 40-44 _ YES 

Claims ?1-1Q. 45-47 NO 

Industrial applicability (IA) Claims 1-47 ^ 



Claims 



NO 



2. Citations and explanations (Rule 70.7) 

Documents cited in the international search report: 

Dl: EP 1191763, A2 
D2: WO 0221464, A2 
D3: WO 0219593, A2 
D4: US 6112078, A 
D5: WO 0167716, Al 

Dl relates to an access authentication system provided for 
authenticating access for visitors to a wireless local area 
network (W-LAN) , the operator of which administers a visitor 
authentication, authorisation and accounting (VAAA) server. 
The user, on requesting visiting access to the W-LAN, inputs; 
via the VAAA server, identity information that enables the 
. HAAA to issue a personal identification number (PIN) which is 
encoded and forwarded, preferably by way of a short message 
service (SMS), to the user's mobile telephone. This encoded 
PIN is transferred to the browser to authenticate the 
requested visiting access to the W-LAN, and the costs 
associated with such access are billed to the user's cellular 
mobile account; the requested access being achieved via the 
user's browser. Alternatively, the user may call the VAAA on 
the mobile telephone to provide said identity information, in 
which case, the subject telephone call is preferably forwarded 
to the HAAA via a premium rate call unit. 



D2 provides a method of ordering, paying for and delivering 
goods and services using a mobile station. This method starts 
by authenticating the mobile station is permitted access to a 
telecom infrastructure. It then accesses a gateway by the 

. . . / ... 
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Supplemental Box 



In case the space in any of the preceding boxes is not sufficient. 
Continuation of: BOX V 

mobile station and transmits an identification code for the 
mobile station to the gateway. This method then requests a 
digital certificate by the mobile station from the gateway 
used for ordering and paying for a product or service from a 
seller using the certificate. The method then verifies the 
identity of the mobile station by the gateway accessing an 
authentication centre and comparing variables computed by the 
mobile station and variables computed by the gateway. It then 
verifies ■ the legitimacy of the gateway by comparing the 
variables computed by the gateway with the variables computed 
by the mobile station. The method delivers a digital 
certificate to the mobile station by the gateway when the 
identity of the mobile station and the gateway has been 
verified. 

D3 reveals a system and method for verifying the identity of 
an end-user. The end-user requests to access an external 
application. The external application sends an authentication 
request to an authentication server, which generates a random 
token- The generated token is transmitted to the end-user. The 
end-user enters the generated token and a personal 
identification number into a cellular terminal connected to a 
GSM network. At least the token is encrypted using a secret 
key stored within the cellular terminal and transmitted 
through the GSM network to an authentication gateway. The 
token is decrypted by the authentication gateway using either 
the same secret key or a key matched to the secret key. The 
token is then transmitted to the authentication server where 
the received key is compared to the generated key. The results 
of the comparison are transmitted to the external application. 

D4 relates to a method for obtaining at least one item of user 
authentication data. The method involves obtaining user 
specific authentication data at least partly by using paging 
or short message service. 

D4 and D5 are state of the art documents. 

The claimed invention is based on the idea that a data 
transfer device user is authenticated utilizing the 
identification data of the subscriber of a mobile 
communications system . 



. . . / . . . 
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The invention according to independent claims 1 and 24 differs 
from Dl, which is the most relevant document, by the steps of 
checking the access rights of the subscriber and by generating 
a password for logging in to the service. However in Dl, an 
authentication of. the subscriber, requesting access to a 
service, is made by using the personal identification number 
(PIN) . Also, identity information is used as input via the 
VAAA for issuing personal access cod (PIN) (abstract) . 

In D2 a digital certificate is used, in response to a request 
including identity information, to authenticate and give the 
user access to services (page 3, "Disclosure of the 
invention") . 

In D3, a procedure is mentioned for generating a logging in 
password in response to a service request. This access request 
includes identification information in the form of a Mobile 
Subscriber ISDN number (MSISDN) (page 1 line 5- page 3, line 
22; page 8, line 20- line 27; page 11, line 1- line 20) . 

D1-D3 discloses inventions that solve the problem of 
authenticating a subscriber to access a requested service in 
an efficient way. 

Thus, with reference to any of D1-D3, the invention according 
to the independent claims 1 and 24 is obvious to a person 
skilled in the art and therefore not considered to involve an 
invent i ve s t ep . 

The invention according to dependent claims 2-16, 21-23, 25-39 
and 45-47 comprises only steps and details that are considered 
obvious to a person skilled in the art and therefore not 
considered to involve an inventive step, with reference to Dl- 
D3 . 
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